dgraph-io/dgraph · error

unsupported signing algorithm: %v

Error message

unsupported signing algorithm: %v

What it means

parseJWTKey switches on the algorithm prefix (HS/ES/RS|PS/EdDSA). If the resolved jwt.SigningMethod falls into none of these branches, it returns this error as a final safety net for algorithms the ACL path does not support.

Source

Thrown at x/acl_enc_keys.go:126

		}
		return pk, &pk.PublicKey, nil

	case strings.HasPrefix(alg.Alg(), "RS") || strings.HasPrefix(alg.Alg(), "PS"):
		pk, err := jwt.ParseRSAPrivateKeyFromPEM(key)
		if err != nil {
			return nil, nil, errors.Wrapf(err, "error parsing ACL key as RSA private key")
		}
		return pk, &pk.PublicKey, nil

	case alg.Alg() == "EdDSA":
		pk, err := jwt.ParseEdPrivateKeyFromPEM(key)
		if err != nil {
			return nil, nil, errors.Wrapf(err, "error parsing ACL key as EdDSA private key")
		}
		return pk.(crypto.Signer), pk.(ed25519.PrivateKey).Public(), nil

	default:
		return nil, nil, errors.Errorf("unsupported signing algorithm: %v", alg.Alg())
	}
}

func checkAclKeyLength(alg jwt.SigningMethod, key Sensitive) error {
	if !strings.HasPrefix(alg.Alg(), "HS") {
		return nil
	}

	sl, err := strconv.Atoi(strings.TrimPrefix(alg.Alg(), "HS"))
	if err != nil {
		return errors.Wrapf(err, "error finding sha length for algo %v", alg.Alg())
	}

	// SHA length has to be smaller or equal to the key length
	if sl > len(key)*8 {
		return errors.Errorf("ACL key length [%v <= %v] bits for JWT algorithm [%v]", len(key)*8, sl, alg.Alg())
	}
	return nil

View on GitHub (pinned to 759e242be6)

Solutions

1. Use a standard supported algorithm: HS256/384/512, ES256/384/512, RS256/384/512, PS*, or EdDSA
2. Remove any custom jwt.SigningMethod registrations that could be picked up
3. Inspect alg.Alg() in the message to identify the offending algorithm

Example fix

// before
--acl "...;jwt-alg=none"
// after
--acl "...;jwt-alg=HS256"

allowed := map[string]bool{"HS256":true,"HS384":true,"HS512":true,"RS256":true,"RS384":true,"RS512":true,"ES256":true,"ES384":true,"ES512":true,"EdDSA":true}
if !allowed[algStr] { return fmt.Errorf("alg %q not supported for ACL", algStr) }

if _, err := x.GetEncAclKeys(flag, encKey); err != nil {
    if strings.Contains(err.Error(), "unsupported signing algorithm") {
        log.Fatalf("use a standard HS/ES/RS/PS/EdDSA algorithm")
    }
    return err
}

When it happens

Trigger: GetEncAclKeys resolving a signing method whose Alg() is none of the handled prefixes — possible with nonstandard or future algorithms returned by jwt.GetSigningMethod (e.g. custom registered methods or 'none').

Common situations: Rare in practice; occurs when a custom jwt.SigningMethod was registered globally or an unusual alg string resolves to an unexpected method.

Related errors

• error parsing ACL key as ECDSA private key
• error parsing ACL key as RSA private key
• error parsing ACL key as EdDSA private key
• Authorize guardian of the galaxy, extracting jwt token, erro
• while getting jwt auth token

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/101f1826a189c925. Report an issue: GitHub.